CVE-2026-70372 Koha Community CVE debrief

Who should care

Koha administrators, library staff with reports module access, and security teams responsible for library management systems should be aware of this vulnerability and take necessary actions to restrict access and implement input validation and sanitization for report parameters. Additionally, they should monitor for suspicious database activity and apply vendor patches or updates when available. Conducting regular security audits and vulnerability assessments is also recommended. Security teams should verify and limit report module access, and consider compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and source tracking may also be necessary to ensure complete remediation. Rollback/change windows should be considered if immediate patching is not feasible. Monitoring and detection capabilities should be reviewed to ensure they can detect potential exploitation attempts. Vulnerability management processes should be updated to include this type of vulnerability in regular scans and risk assessments. Overall, a coordinated effort is required to address this vulnerability and prevent potential data breaches. The CVE record and NVD detail page provide further information on this vulnerability. Koha bugzilla entry and release notes may also offer additional context for affected deployments and mitigation strategies. Security teams should review these sources to better understand the vulnerability and plan their response accordingly. They should also consider conducting a thorough risk assessment to identify potential vulnerabilities in other components of their library management systems. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their systems and data from potential attacks. It is essential to prioritize and address this vulnerability promptly to prevent potential exploitation. Security teams should work closely with IT teams to ensure that necessary patches and updates are applied, and that compensating controls are implemented where necessary. Effective communication and coordination between teams are critical to ensuring the successful remediation of

Technical summary

The reports/bor_issues_top.pl script in Koha is vulnerable to SQL injection. An authenticated staff user with reports module permissions can inject arbitrary SQL by manipulating request parameters, allowing access to sensitive data such as borrowers, api_keys, and sessions. The vulnerability allows reading any table accessible by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY); Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments, and the Limit parameter is appended raw to a LIMIT clause.

Defensive priority

Authenticated staff users with reports module permissions can inject SQL; verify and limit report module access.

Recommended defensive actions

• Restrict reports module access to necessary personnel
• Implement input validation and sanitization for report parameters
• Monitor for suspicious database activity
• Apply vendor patches or updates when available
• Conduct regular security audits and vulnerability assessments

Evidence notes

The CVE description indicates that Koha's reports/bor_issues_top.pl is vulnerable to SQL injection. An authenticated staff user can inject arbitrary SQL by manipulating request parameters. The vulnerability allows reading any table accessible by the Koha database user. Evidence limits suggest verifying report module access and monitoring database activity.

Official resources